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SPECIAL NOTES 

API publications necessarily address problems of a general nature. With respect to partic- 
ular circumstances, local, state, and federal laws and regulations should be reviewed. 

API is not undertaking to meet the duties of employers, manufacturers, or suppliers to 
warn and properly train and equip their employees, and others exposed, concerning health 
and safety risks and precautions, nor undertaking their obligations under local, state, or fed- 
eral laws. 

Information concerning safety and health risks and proper precautions with respect to par- 
ticular materials and conditions should be obtained from the employer, the manufacturer or 
supplier of that material, or the material safety data sheet. 

Nothing contained in any API publication is to be construed as granting any right, by 
implication or otherwise, for the manufacture, sale, or use of any method, apparatus, or prod- 
uct covered by letters patent. Neither should anything contained in the publication be con- 
strued as insuring anyone against liability for infringement of letters patent. 

Generally, API standards are reviewed and revised, reaffirmed, or withdrawn at least every 
five years. Sometimes a one-time extension of up to two years will be added to this review 
cycle. This publication will no longer be in effect five years after its publication date as an 
operative API standard or, w^here an extension has been granted, upon republication. Status 
of the publication can be ascertained from the API Standards department telephone (202) 
682-8000. A catalog of API publications, programs and services is published annually and 
updated biannually by API, and available through Global Engineering Documents, 15 Inv- 
erness Way East, M/S C303B, Englewood, CO 801 .12-5776. " 

This document was produced under API standardization procedures that ensure appropri- 
ate notification and participation in the developmental process and is designated as an API 
standard. Questions concerning the interpretation of the content of this standard or com- 
ments and questions concerning the procedures under which this standard was developed 
should be directed in writing to the Director of the Standards department, American Petro- 
leum Institute, 1220 L Street, N.W., Washington, D.C. 20005. Requests for permission to 
reproduce or translate all or any part of the material published herein should be addressed to 
the Director, Business Services. 

API standards are published to facilitate the broad availability of proven, sound engineer- 
ing and operating practices. These standards are not intended to obviate the need for apply- 
ing sound engineering judgment regarding when and where these standards should be 
utilized. The formulation and publication of API standards is not intended in any way to 
inhibit anyone from using any other practices. 

Any manufacturer marking equipment or materials in conformance with the marking 
requirements of an API standard is solely responsible for complying with all the applicable 
requirements of that standard. API does not represent, warrant, or guarantee that such prod- 
ucts do in fact conform to the applicable API standard. 
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FOREWORD 

This publication was prepared under the direction of a Support Group comprised of mem- 
bers of the API Safety and Fire Protection Subcommittee. The second edition of API RP 2350 
Overfill Protection for Storage Tanks in Petroleum Facilities was rewritten and expanded with 
emergency spill prevention programs in mind and replaced the previous edition in whole and 
in part. This third edition builds on the second edition with an expansion of the Scope to 
include both Class I and Class II hydrocarbon liquids as well as tankage in broader usage. 
Appendixes to the document are intended to provide additional information only. 

This document covers overfill protection for all aboveground storage tanks in petroleum 
facilities, including refineries, terminals, bulk plants, and pipeline terminals that receive 
Class I (flammable) or Class II (combustible) liquids. It is not intended to include service sta- 
tion tanks, process tanks or tanks used in initial crude oil production activities. 

During the development of the current and prior editions of API RP 2350, careful consid- 
eration was given to the benefits provided by overfill protection for tanks in petroleum facili- 
ties relative to: 

• Safety and environmental protection 

• Optimization of the work place and operating practices 

• Inspection, testing, and maintenance 

• Equipment and system selection and installation 

• Safe work and emergency procedures and training 

• Management of change programs relative to tank overfill protection 

All of the sections and appendixes in the document were revised and expanded with the 
second edition. Illustrations and a tank overfill protection summary chart are provided to 
help understand the tank capacity and level definitions. API RP 2350 covers overfill protec- 
tion only. It does not address other issues related to aboveground storage tanks, such as man- 
agement of large diameter storage tanks, tank fire protection, leak control, drainage, and 
other subjects that are covered by a number of API standards and other publications listed in 
the references. 

Starting with the second edition the previous definitions for overfill level, tank fill level, 
and normal fill level were changed. For example, safe fill level became the normal maximum 
allowable tank capacity (normal operating level). The definitions used in the second edition 
continue in this third edition. 

The essential elements of this publication are based on current industry safe operating 
practices and existing consensus standards. Federal, state, and local regulations or laws may 
contain additional requirements that must be taken into account when a tank overfill protec- 
tion program is developed for a specific facility. 

API publications may be used by anyone desiring to do so. Every effort has been made by 
the Institute to assure the accuracy and reliability of the data contained in them; however, the 
Institute makes no representation, warranty, or guarantee in connection with this publication 
and hereby expressly disclaims any liability or responsibility for loss or damage resulting 
from its use or for the violation of any federal, state, or municipal regulation with which this 
publication may conflict. 

Suggested revisions are invited and should be submitted to API. Standards department, 
1220 L Street, NW, Washington, DC 20005, standards@api.org. 



CONTENTS 



1 GENERAL 1 

1 . 1 Introduction 1 

1.2 Scope 1 

1 .3 Definition of Terms 1 

1 .4 General Provisions Applicable to All Facilities 3 

1 .5 Referenced Publications 4 

2 ATTENDED FACILITIES 4 

2.1 Attended Facilities Where Detectors are Not Installed on Tanks 4 

2.2 Installation of Detectors at Attended Facilities 5 

3 UNATTENDED FACILITIES 5 

3.1 Installation of Detectors at Unattended Facilities 5 

3 .2 Installation of Independent Detection and Automatic Shutdown or 

Diversion Systems at Unattended Facilities . 6 

4 PROCEDURES 7 

4. 1 General Written Operating Procedures 7 

4.2 Planning the Product Receipt 7 

4.3 Electronic System Integrity Tests ....... 8 

4.4 Monitoring the Receipt 8 

4.5 Completing the Receipt 8 

4.6 Emergency Procedures and Planning 8 

4.7 Personnel Performance and Training 9 

4.8 Testing, Inspection, and Maintenance 10 

4.9 Abnormal Conditions 10 

APPENDIX A OVERFILL PROTECTION SYSTEM INSTALLATION 11 

APPENDIX B DETERMINING TANK CAPACITY AND PRODUCT LEVELS ... 1 7 
APPENDIX C OVERFILL PROTECTION EQUIPMENT 23 

Figures 

A-l Example External Chamber-type Detector Installation 12 

A-2 Example of a Two-stage Detector Installation for an External 

Floating-roof Tank 13 

A-3 Example of a Two-stage Detector Installation for a Cone-roof Tank 14 

A-4 Example of Tank Level Settings Based on Response Time in a 

Two-stage Detector System 15 

B-l Tank Detector Level and Fill Level Work Sheet 20 

B-2 Tank Overfill Level Work Sheet and Record .21 

C-l Example of a Two-stage Overfill Protection System 24 

C-2 Example of an External Chamber-type Float Switch 25 

C-3 Example of an Optical High-level Detector 26 

C-4 Example for a Heated Thermocouple Assembly — High-level Probe 27 

Tables 

1 Tank Overfill Protection Summary Chart 9 



Overfill Protection for Storage Tanks in Petroleum Facilities 



1 General 

1.1 INTRODUCTION 

Preventing petroleum storage tanks from being overfilled 
is an important safety and environmental concern. The safe 
operation of a petroleum storage facility is dependent on the 
receipt of product into the intended storage tank within its 
denned capacity. Tank overfills can be effectively reduced by 
developing and implementing practical and safe operating 
procedures for storage facilities and by providing for careful 
selection and application of equipment, scheduled mainte- 
nance programs, and employee training. 

In providing for overfill protection for storage tanks, the 
objective is to minimize product overflows that can result in 
environmental and safety hazards, loss of inventory, and dam- 
age to tanks and adjacent areas. Because the level of risk and 
potential loss varies from location to location, a flexible 
approach should be used in providing alternatives for meeting 
the objectives of the facility overfill protection program. Pro- 
cedures should provide for options that include the use of 
trained personnel, safe operating practices, and technology. 

Recognizing the need for flexibility, this document covers 
both manual procedures and automatic systems that can be 
used successfully to protect against overfills. 

1.2 SCOPE 

1.2.1 Applicability 

The scope of this recommended practice (RP) is specifi- 
cally limited to tanks associated with marketing, refining, 
pipeline and similar facilities containing Class I or Class II 
petroleum liquids. This RP does not apply to: 

• Underground storage tanks 

• Aboveground tanks of 1320 U.S. gallons (5000 liters) 
or less 

• Tanks that are integral to a process 

• Tanks containing Class III liquids 

• Tanks containing non-combustible liquids 

• Service stations 

• Loading or delivery from wheeled vehicles (such as 
tank trucks or railroad tank cars) 

1 .2.2 Relationship of This Recommended Practice 
to NFPA 30 

This document was prepared to include consistency with 
NFPA 30-2003 Edition, Chapter 4.6, which includes the fol- 
lowing requirements: 

4.6.1.1 Aboveground tanks at terminals receiving 
transfer of Class I liquids from mainline pipelines or 
marine vessels shall follow formal written procedures to 



prevent overfilling of tanks utilizing one of the following 
methods of protection: 

1 . Tanks gauged at frequent intervals by personnel con- 
tinuously on the premises during product receipt with 
frequent acknowledged communication maintained with 
the supplier so that flow can be promptly shut down or 
diverted. 

2. Tanks equipped with a high-level detection device 
that is independent of any tank gauging equipment. 
Alarms shall be located where personnel who are on duty 
throughout product transfer can promptly arrange for 
flow stoppage or diversion. 

3. Tanks equipped with an independent high-level detec- 
tion system that will automatically shut down or divert 
flow. 

4. Alternatives to instrumentation described in 
4.6.1.1(2) and 4.6.1.1(3), where approved by the author- 
ity having jurisdiction as affording equivalent protection. 

4.6.1.2 Instrumentation systems covered in 4.6.1.1(2) 
and 4.6.1.1(3) shall be electrically supervised or equiva- 
lent. 

4.6.1.3 Formal written procedures required 4.6.1.1 
shall include the following: 

1. Instructions covering methods to check for proper 
line-up and receipt of initial delivery to tank designated 
to receive shipment. 

2. Provisions for training and monitoring the perfor- 
mance of operating personnel by terminal supervision. 

3. Schedules and procedures for inspection and testing 
of gauging equipment and high-level instrumentation 
and related systems. Inspection and testing intervals shall 
be acceptable to the authority having jurisdiction but 
shall not exceed 1 year. 

Note: Reprinted with, permission from NFPA 30-2003 Flammable 
and Combustible Liquids Code, Copyright © 2003, National Fire Pro- 
tection Association, Quincy, MA 02269. This reprinted material is not 
the complete and official position of the NFPA on the referenced sub- 
ject, which is represented only by the standard in its entirety. 

1.3 DEFINITION OF TERMS 

For the purposes of this document, the following defini- 
tions apply: 

1 .3.1 attended facility: A facility that has assigned per- 
sonnel continuously on the premises during receipt of product 
from a mainline pipeline or marine vessel. An unattended 
facility does not have assigned personnel on the premises 
continuously during product receipt from a mainline pipeline 
or marine vessel. 
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1.3.2 authority having jurisdiction: The organization, 
office, or individual responsible for approving equipment, an 
installation, or a procedure. 

1 .3.3 capacity: The volume (amount) of product con- 
tained in a tank at predesignated levels. 

1 .34 detectors and detector systems: The following 
are terms related to detectors and detector systems: 

a. level detector: A product level sensing device that actu- 
ates an initial alarm/signal that allows sufficient time for 
facility operating personnel ("persons in charge for marine 
terminals") to acknowledge or respond to divert or shut off 
product flow before the product in the tank reaches a prede- 
termined level. 

b. high-high-level detector: A product level sensing 
device in a single-stage detector system and in a two-stage 
detector system, usually located at or above the safe fill level, 
that actuates the alarm/signal to provide sufficient time to 
shut off or divert product flow before the overfill level is 
reached. 

c. high-level detector: Product level sensing device in a 
two-stage detector system that actuates the first alarm/signal 
if a tank is filled to a predetermined level below the level 
where the high-high-level detector is set, and which allows 
sufficient time to shut off or divert product flow before the 
product in the tank reaches the high-high-level detector. 

d. single-stage detector system (high-high-level 
detector): In a single-stage detector system the high-high- 
level detector shall be located at or above the safe fill level 
and shall alarm/signal to provide sufficient time to shut off or 
divert product flow before the overfill level is reached. 

e. two-stage detector system (high-level and high- 
high-level): hi a two-stage detector system, the first-stage 
(high-level) detector shall be located at or above the normal 
fill level and shall alarm/signal to allow sufficient time for 
product shutofl or diversion before the safe fill level is 
reached. The second- stage (high-high-level) detector shall be 
located at or above the safe fill level and shall alarm/signal to 
provide for sufficient time to shut off or divert product flow 
before the overfill level is reached. 

f. independent level detector: A product level sensing 
device that is separate and independent from any automatic 
gauging equipment on the tank. High-high-level detectors in 
single-stage and in two- stage detector systems shall always 
be independent detectors. A high-level detector in a two-stage 
detector system may or may not be an independent detector. 

Note: NFPA 30 allows for the use of non-independent, integrated 
level detector systems (such as radar, servo-gauging, and hydrostatic 
gauging systems), if approved by the authority having jurisdiction as 
providing equivalent protection 

1.3.5 facility operator: The facility owner, operator 
(manager, supervisor, or other assigned person[s]) responsi- 



ble for receiving product from the transporter; typically with 
decision-making authority. 

1 .3.6 flammable and combustible liquids: NFPA 30- 

2003 defines the following classes of liquids: 

a. Class I liquid: a flammable liquid with a closed cup flash 
point below 100°F (37.8°C) and a Reid vapor pressure not 
exceeding 40 lb. per square in. absolute (2068 mm of mer- 
cury) at 100°F (37. 8°C). 

b. Class II liquid: A combustible liquid with a closed cup 
flash point at or above 100°F (37.8°C) and below 140°F 
(60°C). 

c. Class III A liquid: A combustible liquid with a closed cup 
flash point at or above 140°F (60°C) and below 200°F 
(93°C). 

d. Class III B liquid: A combustible liquid with a closed cup 
flash point at or above 200°F (93°C). 

1.3.7 hazard: A condition or inherent physical or chemi- 
cal characteristic (flammability, toxicity, coirosivity, stored 
chemical electrical, hydraulic, pressurized or mechanical 
energy) that has the potential for causing harm or damage to 
people, property, or the environment. 

1 .3.8 mainline pipeline: A pipeline that transports petro- 
leum products between facilities, or from refineries to termi- 
nals and other facilities, and does not include pipelines used 
to transfer products within facilities (except those used for 
product transfer from marine vessels). 

1 .3.9 marine vessel: A barge or tanker ship that delivers 
product directly into petroleum facility tanks (usually through 
facility pipelines). 

1.3.10 norma! fill level (normal capacity): Hie level 
up to which the tank is allowed to receive product at the max- 
imum allowable receiving flow rate for a predetermined time 
prior to reaching the safe fill level. Hie predetermined time 
should be based on the facility operator's experience for the 
facility and the tank involved. The normal fill level is estab- 
lished at the lower of the following two levels so that appro- 
priate action can be taken to prevent an overfill: 

a. A level that allows sufficient time for the flow to be com- 
pletely stopped or diverted before or when the level of the 
product in the tank reaches the pre-established safe fill level 
(Normal fill level never exceeds safe fill level.) 

b. A level, determined by the facility operator depending on 
the tank's physical condition (leaks, structural strength, and 
so forth) or the operating practices (e.g., partial or split prod- 
uct receipts, relief allowances, and so forth), that limits the 
tank capacity to less than that normally available at the usual 
safe fill level. 

1.3.11 overfill level (maximum capacity): The maxi- 
mum fill level of product within a tank as measured from the 
gauging reference point (that is, striker plate) above which 
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level any additional product will overfill and spill out of the 
tank; or at which level contact or damage will occur between 
the floating roof and the tank structure or appurtenances. 

1.3.12 person in charge: A trained and experienced 
individual designated as a person in charge of transfer opera- 
tions at marine terminals (U.S. Coast Guard regulatory term 
from 33 CFR 154.700). 

1.3.13 prod uct: The Class I or Class II liquid received into 
tanks (such as from mainline pipelines or marine vessels). 

1.3.14 risk: The probability of exposure to a hazard whi ch 
could result in harm or damage. 

1 .3.15 risk assessment: The identification and analysis 
with judgements of probability and consequences, either 
qualitative or quantitative, of the likelihood and outcome of 
specific events or scenarios that result in harm or damage. 

1 .3.16 risk-based analysis: A review of potential haz- 
ards and needs to eliminate or control such hazards based on 
a formalized risk assessment. 

13.17 safe fill level (tank rated capacity): The safe 
fill level up to which the tank is allowed to receive product 
deliver} 7 after the normal fill level is attained. The safe fill 
level is always below the overfill level. The safe fill level is 
established by detemnning the amount of time required to 
take the appropriate action necessary to completely shut 
down or divert product flow before the level of product in the 
tank reaches the overfill level. The safe fill level is established 
by facility operators for each specific tank depending on the 
type of tank, its internal configuration and condition, and 
operating practices and policies based on judgements of haz- 
ards and associated risks. 

1 .3.18 tank product levels: Levels established by facil- 
ity operators are based on: 

a. Field experience and operating practices for each facility 
and each specific tank; 

b. Operating parameters for valves and manifolds; 

c. Tank capacities and physical conditions; 

d. Amount of product to be delivered; and 

e. Rate of product flow into each tank. 

See Appendices A and B for information on calculating 
tank product levels. 

1.3.19 tank strapping chart (tank record): A chart 
(or record) developed for each individual tank specifying 
the essential values related to tank capacity, normal fill 
level, safe fill level, overfill level, and detector setting levels 
(see API Std 2550). 

1.3.20 transfer operations: All activities associated 
with product receipt, including the associated notification 
(either verbal, electronic, or by other means) of a potential 
tank overfill and shutdown or diversion of product to prevent 
a potential tank overfill. 



1.3.21 transporter: The mainline pipeline person or 
marine vessel person who is responsible for product transfer 
operations. 

1 .4 GENERAL PROVISIONS APPLICABLE TO ALL 
FACILITIES 

1 .4.1 Protection against tank overfill is best achieved by: 

a. Awareness of available tank capacity and inventory, and 

b. Careful monitoring and control of product movement. 

Monitoring of available tank capacity is accomplished 
either manually or by use of an automatic tank gauging sys- 
tem. This, together with established orderly emergency shut- 
down and product diversion procedures, provides for overfill 
protection. Aboveground storage tank high-level and high- 
high-level detectors with alarm/signal systems constitute an 
additional means of protection against tank overfills and shall 
be used w r here required by facility operator or transporter pol- 
icy or regulations. 

CAUTION: High-level detectors and/or automatic shutdown/ 
diversion systems on tanks containing Class I and Class II liq- 
uids shall not be used for control of routine tank filling opera- 
tions. These devices are intended to signal a potential 
emergency and initiate certain manual responses or activate 
automatic response mechanisms. 

Note: Detectors, when installed on tanks not covered by this docu- 
ment, may be an integral part of a product level gauging system 
device, provided that they do not perform, any shutdown or safety 
interlock function. 

1 .4.2 The normal fill level (normal capacity), safe fill level 
(tank rated capacity), and overfill level (maximum capacity) 
for each tank m facilities covered by this document shall be 
established and entered in the tank strapping chart (tank 
record). The levels shall also be prominently displayed by the 
facility operator near the tank gauge hatches and/or ground 
level gauges where manual operations are performed, or 
where manual operations are required as a backup in the 
event of system failure. Appropriate tank gauging reference 
information should be available in the control room. 

1.4.2.1 To assist in scheduling product receipts, facility 
operators shall indicate the normal fill level (normal capacity), 
safe fill level (tank rated capacity), overfill level (maximum 
capacity), and any other critical heights on the tank strapping 
chart, tank record card, computer record or calibration chart for 
each tank in the facility to which the document applies. It may- 
be beneficial to provide this information in the area where 
gauging is conducted. This information shall also be provided 
to transporters when they are responsible for filling the tanks. 

1 .4.2.2 If acceptable calibration charts are not available, 
tanks shall be calibrated and charts developed in accordance 
with API Std 2550. 
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1.4.2.3 The normal fill level (normal capacity), safe fill 
level (tank rated capacity), and overfill level (maximum 
capacity) for the tank(s) receiving product shall be noted on 
the tank product transfer or receipt form. This information 
shall be confirmed with the transporter prior to receipt and 
provided to the transporters when they are responsible for fill- 
ing the tanks. 

1.4.3 Prior to product receipt, the tank(s) designated to 
receive product shall be gauged manually, or by an indepen- 
dent automatic gauging and measuring system, to confirm 
that adequate capacity is available to receive the amount of 
product scheduled for delivery. Any expected volume 
increase due to product temperature lise in the tank(s) shall be 
considered when determining the available room for product. 
This information shall be recorded on the tank product trans- 
fer or receipt form(s) and made available to the transporter, as 
appropriate. Where automatic gauging and measuring sys- 
tems are used, regular inspection, maintenance, and checks of 
their capability and performance are required. 

1 .4.4 All documentation of the above activities associated 
with the receipt of product from transporters shall be main- 
tained on file in the facility for an appropriate period of time 
as determined by facility operator policy, or as established by 
regulation or other authority. Documentation relating to 
inspection and maintenance of systems shall be maintained 
for a minimum of 1 year (NFPA 30, Section 2-10.2) or longer, 
as required by operator policy, regulation, or other authority. 

1.5 REFERENCED PUBLICATIONS 

1 .5.1 The following recommended practices and standards 
are referenced in this document: 



API 
RP500 



RP 2003 



RP2009 



RP2021 



Publ2021A 



RP2026 



Publ2201 



Std2545 



Classification of Locations for Electrical 
Installations at Petroleum Facilities Clas- 
sified as Class I, Division 1 and Division 2 
Protection Against Ignitions Arising Out of 
Static, Lightning, and Stray Currents 
Safe Welding, Cutting, and Hot Work Prac- 
tices in the Petroleum and Petrochemical 
Industries 

Management of Atmospheric Storage Tank 
Fires 

Interim Study — Prevention and Suppres- 
sion of Fires in Large Aboveground 
Atmospheric Storage Tanks 
Safe Access/ Egress Involving Floating 
Roofs of Storage Tanks in Petroleum 
Service 

Safe Hot Tapping Practices in the Petro- 
leum & Petrochemical Industries 
Method of Gaging Petroleum and Petro- 
leum Products 



Std2550 
Std2610 

MPMS3.1A 

EPA 1 

40 CFR 112 

NFPA 2 
30 

OSHA 3 

1910.120(q) 

OSHA 2254 

USCG 4 

33 CFR 700 
Part 154 



Measurement and Calibration of Upright 
Cylindrical Tanks 

DesigtJ, Construction, Operation, Mainte- 
nance and Inspection of Terminal and Tank 
Facilities 

Manual Gauging of Petroleum and Petro- 
leum Products 



Spill Prevention Control and Countermea- 
sure (SPCC) Rule 



Flammable and Combustible Liquids Code 

Hazardous Waste Operations and Emer- 
gency Response — Emergency Response 
Program 

Training Reqidrements in OSHA Standards 
& Training Guidelines — 1998 (Revised) 

Subpart D — Facility Operations for 
Facilities Transferring Oil or Hazardous 
Material in Bulk 



1 .5.2 Other Reference 

Magraw-Hill, Aboveground Storage Tanks by Phillip E. 
Myers, ISBN: 007044272X. 

2 Attended Facilities 

2.1 ATTENDED FACILITIES WHERE DETECTORS 
ARE NOT INSTALLED ON TANKS 

2.1.1 To protect against overfills at attended facilities 
where detectors are not installed on tanks, written procedures 
for product receipt, shutdown and diversion shall be devel- 
oped by the facility operator, with assistance from the trans- 
porter, or which are acceptable to the transporter. The 
requirements in 2.1 and Section 4 of this RP shall be included 
in the written procedures. 



Environmental Protection Agency, Ariel Rios Building, 1200 Penn- 
sylvania Avenue, NW, Washington, D.C. 20460. EPA Regulations 
are posted on, and can be downloaded from, the EPA web site; 
www. epa.gov 

-National Fire Protection Association, 1 Batterymarch Park, Quincy, 
Massachusetts 02169. www.nfpa.org 

Occupational Safety and Heatlh Administration, Department of 
Labor, 200 Constitution Avenue, NW, Washington, D.C. 20210. 
OSHA Regulations are posted on, and can be downloaded from, the 
OSHA web site: www.osha.gov 

4 U.S. Coast Guard Marine Safety Center (part of DOT), Available 
from the U.S. Government Printing Office, Washington, D.C. 20036. 
www. uscg.mil 
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2.1 .2 During product receipt, frequent acknowledged com- 
munication shall be maintained between the facility operator 
and the transporter, to shut down or divert product flow, if 
necessary. 

2.1.3 The tank(s) designated to receive product shall be 
checked by personnel responsible for facility operations 
("person in charge" at marine facilities) immediately after the 
stall of product transfer to verify that product is flowing into 
the correct tank and that the gauging equipment, where 
installed, is operative. 

2.1 .4 During product receipt, tanks shall be checked peri- 
odically by personnel responsible for facility operations, in 
accordance with established facility procedures, to ensure 
that the product continues to flow into the correct tank and 
that the tank capacity remains sufficient to receive the amount 
of product scheduled for delivery. Gauge readings shall be 
taken and recorded when checking tanks during product 
receipt. 

2.1.5 During product receipt, the tank farm area shall be 
periodically inspected by personnel responsible for facility 
operations to ensure the integrity of the piping, tanks, pumps, 
dikes and/or other containment and drainage systems, and to 
ensure that no unauthorized activities are taking place that 
would affect product receipt. 

2.1 .6 If a tank is to be filled above its normal fill level (nor- 
mal capacity) up to its safe fill level (tank rated capacity), a 
trained and qualified person shall be assigned by the facility 
operator to be present at the tank. 

Note: API does not recommend the practice of routinely filling a 
tank above the safe fill level (tank rated capacity)- This increases the 
risk of overfill and shall be avoided whenever practical. 

2.1 .6.1 The assigned person shall continuously monitor the 
product receipt as the product level in the tank approaches the 
safe fill level (or as the capacity approaches the tank rated 
capacity). 

2.1.6.2 During this period, the assigned person shall be 
provided with a direct means of communication to the trans- 
porter, to notify the transporter to immediately stop or divert 
product flow in the event of an emergency. 

2.1 .6.3 Monitoring shall continue until the transfer is com- 
plete, all product flow has stopped and the tank receipt valves 
are closed. 

2.1.7 To prevent other consequential damages, such as 
hydraulic shock or overpressuring of the piping systems, the 
shutdown or diversion procedure should be compatible with 
the transporter's operations. 



2.2 INSTALLATION OF DETECTORS AT 
ATTENDED FACILITIES 

2.2.1 Level detectors are not required for tanks at attended 
facilities. The facility operator's decision whether or not to 
install overfill protection equipment at an attended facility 
should be based on an evaluation of the following factors: 

a. Facility's location (e.g., tanks located in areas where a 
tank overfill might endanger a place of habitation or public 
assembly). 

b. Tank size. 

c. Tank diking and spacing. 

d. Soil and groundwater conditions. 

e. Operating practices. 

f. Other factors that would be affected by an overfill. 

Note: It is recognized that all aboveground storage tanks and partic- 
ularly those in excess of 150 ft in diameter which contain Class I or 
Class II liquids have the potential for a significant emergency condi- 
tion should an overfill occur. Single-stage high-high-level or two- 
stage high-high-level and high-level detector, alarm/signal and shut- 
down systems may be installed on these and other tanks at attended 
facilities at the discretion of the facility operator to provide addi- 
tional overfill protection, or as required by government regulation or 
an authority having jurisdiction, 

2.2.2 Where level detectors are installed at attended facili- 
ties, the requirements of Section 3 of this RP shall apply. If an 
electrical or mechanical failure occurs that affects the level 
detectors, product receipt shall stop and not recommence 
until (a) detectors are fftnctionhig properly or (b) manual 
operations and procedures are implemented in accordance 
with those required in 2.1 of this document for attended facil- 
ities without detectors. 

3 Unattended Facilities 

3,1 INSTALLATION OF DETECTORS AT 
UNATTENDED FACILITIES 

3.1 .1 At unattended facilities, receipt of product is not usu- 
ally monitored by persomiel on site or hi the immediate area 
of the receiving tank(s). The product flow is controlled from 
remote locations that are equipped with alarm/signal annunci- 
ators activated by independent level detectors installed on 
tanks at each receiving facility. These annunciators alert per- 
sonnel at the remote locations so that an orderly shutdown or 
diversion of product flow can be accomplished in time to pre- 
vent tank overfills. 

3.1.2 Product transfer to an unattended facility shall be 
continuously monitored from a control center by the facility 
operator, transporter, or by a computer. 

3.1 .3 If a mechanical, electrical, or other detector system 
failure occurs, the product receipt shall be immediately 
stopped until such time as manual operations in accordance 
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with those in 2.1 for attended facilities without detectors can 
be implemented. 

3.1 .4 The high-high-level detector in a single or two-stage 
system shall be designed to activate an alarm/signal that 
allows for sufficient time for an orderly shutdown or diver- 
sion of product to take place before an overfill occurs. The 
amount of time required will depend on operating conditions 
and facility practices, including both manual and automatic 
shutdown or diversion procedures. 

3.1.4.1 Single detector (high-high-level detector) system: 
When only one detector is used, this high-high-level detector 
shall be located at or above the safe fill level and shall alarm/ 
signal to provide sufficient time to shut off or divert product 
flow before the overfill level is reached. 

3.1 .4.2 Two-stage detector (high-level and high-high-level 
detector) system: In a two-stage system, the first-stage high- 
level detector is usually located at or above the normal fill 
level and shall alarm/signal to allow sufficient time for prod- 
uct shutoff or diversion when the safe fill level is reached. The 
second-stage high-high-level detector shall be located at or 
above the safe fill level and shall alarm/signal to provide for 
sufficient time to shutoff or divert product flow before the 
overfill level is reached. 

3.1.5 When used for overfill protection, the high-high-level 
detector in a single-stage system, and the high-high-level 
detector in a two-stage system, shall be independent of the 
automatic tank gauge system to provide greater reliability and 
to comply with the requirements of NFPA 30-2003, Section 
4.6.1.1(2) and 4.6.1.1(3) 

Note: State-of-the-art equipment with integrated (not independent) 
hardware can provide superior reliability for detecting high and 
high-high levels. NFPA 30-2003 Section 4.6.1.1(4) allows for the 
use of non-independent alternative systems, provided they are 
approved by the authority having jurisdiction. 

3.1 .6 Where installed, two- stage (high-level and high-high- 
level) detector systems shall comply with at least one of the 
two following requirements: 

a. If an automatic tank gauge is incorporated as a component 
of the high-level (first-stage) detector, an independent high- 
high-level (second-stage) detector shall be provided. 

b. Both the high-level (first-stage) detector and the high- 
high-level (second-stage) detector shall be independent of the 
automatic gauging system on the tank. 

Note: State-of-the-art equipment with integrated (not independent) 
hardware can provide superior reliability for detecting high and 
high-high levels NFPA 30-2003 Section 4.6.1.1(4) allows for the use 
of nonindependent alternative systems, provided they are approved 
by the authority having jurisdiction. 

3.1 .7 Where a two-stage system is installed, the first-stage 
(high-level detector) shall activate when product flow into the 
tank reaches a predetermined level that provides sufficient 



time for appropriate action to stop or divert product flow 
before the second stage (high-high-level detector) is reached. 

3.1 .8 If a tank is to be filled above its normal fill level (nor- 
mal capacity) up to its safe fill level (tank rated capacity), a 
trained and qualified person shall be assigned by the facility 
operator or the transporter to monitor the operation and, if 
necessary, take action to stop or divert product flow to prevent 
an overflow. 

Note: API does not recommend the practice of routinely filling a 
tank above the safe fill level (tank rated capacity). This increases the 
risk of overfill and shall be avoided whenever practical. 

3.1.8.1 During this period, the assigned person shall be 
provided with a direct means of communication to notify the 
transporter to immediately stop or divert product flow in the 
event of an emergency. 

3.1.8.2 If the transporter does not acknowledge appropriate 
compliance, the assigned person shall be instructed to take 
immediate action within the facility to stop or divert the flow. 

3.1.8.3 Monitoring of the operations by the assigned per- 
son shall continue until the transfer is complete, all product 
flow has stopped and the tank receipt valves are closed. 

Note: It should be recognized that all aboveground storage tanks and 
particularly those in excess of 150 ft in diameter, which contain 
Class I or Class 11 liquids, have the potential for a significant emer- 
gency condition should an overfill occur. These concerns are dis- 
cussed in API RP 2021 Management of Atmospheric Storage Tank 
Fires and Publication 2021 A Interim Study— Prevention and Sup- 
pression of Fires in Large Aboveground Atmospheric Storage Tanks. 

3.1.9 To prevent other consequential damages, such as 
hydraulic shock or overpressuring the piping systems, the 
shutdown or diversion procedure should be compatible with 
the transporter's operations. 

3.2 INSTALLATION OF INDEPENDENT 

DETECTION AND AUTOMATIC SHUTDOWN 
OR DIVERSION SYSTEMS AT UNATTENDED 
FACILITIES 

Note: This section is consistent with the requirements of NFPA 30- 
2003, Section 6.1.1(3). 

3.2.1 Tanks in fully automated operation at unattended 
facilities shall be equipped with independent single-stage 
high-high-level or two-stage high and high-high-level detec- 
tor systems that automatically initiate shut down procedures 
or divert product flow when product in the tank reaches a pre- 
determined level. These systems shall also activate shutdown 
or diversion in the event of a pow r er failure in the level detec- 
tion system. 

3.2.2 Product transfer to an unattended facility shall be 
continuously monitored from a control center by computer. 
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3.2.3 Automatic shutdown or diversion can be accom- 
plished by one of the following methods: 

a. Automatically closing the product inflow valve on the 
tank. 

b. Shutting down the pumping system. 

c. Diverting the flow with automatic valves to another tank or 
pipeline. 

d. Closing the intake valve at the pipeline manifold or 
connection. 

3.2.4 Where automatic shutdown systems are provided, the 
receiving valve or valves for each tank and/or the intake valve 
at the pipeline connection, as well as valves controlling prod- 
uct diversion, shall be equipped with power actuators. 

3.2.4.1 The power actuators may be either electrically, 
hydraulically, or pneumatically operated and shall incorpo- 
rate a disconnect feature to permit manual override operation. 

3.2.4.2 The valve closure rate should prevent excessive 
hydraulic pressure or hydraulic shock when the valve is 
closed. The control system should close the valve at a rate 
previously agreed to by both the facility operator and the 
transporter. 

3.2.4.3 Position indicators should indicate valve positions 
and valve operation. 

3.2.5 The facility piping system should be analyzed to 
determine whether a relief system will be needed to protect 
low pressure manifold piping. To prevent other consequential 
damages, such as hydraulic shock or overpressuring of the 
piping systems, the design and operation of the shutdown sys- 
tem or diversion procedure should be compatible with the 
transporter's operations. 

3.2.6 When notification is received that the product in the 
tank has reached its predetermined high-high detector level in 
a single-stage or two-stage system, a signal activates a typical 
automatic valve control system that shall perform the follow- 
ing functions: 

a. If the valve is being opened remotely when the appropriate 
high-level detector signal or high-high-level detector signal is 
received, the valve should immediately stop opening and 
immediately start to close at the predetemxined rate. 

b. If the valve is being closed remotely when the appropriate 
high-level detector signal or high-high-level detector signal is 
received, the valve shall continue to close at the predeter- 
mined rate. 

3.2.7 If a mechanical or electrical failure of the detector 
system occurs, product receipt (or pumping) shall be immedi- 
ately stopped. For receipt to recommence, manual operations 
in accordance with those required in 2.1 for attended facilities 
without detectors shall be implemented. 



4 Procedures 

4.1 GENERAL WRITTEN OPERATING 
PROCEDURES 

4.1.1 To provide for protection against overfills, written 
operating procedures shall be established by the facility oper- 
ator and, where appropriate, coordinated with and agreed to 
by the transporter. When developing written procedures the 
following should be considered: 

a. These procedures shall comply with the requirements of 
NFPA 30-2003, Section 4.6.1.3, and with applicable federal, 
state and local codes, regulations, and requirements. 

b. Facility operators should consider recognized industry 
safe work practices covered in this and other referenced API 
documents and standards. 

c. The written operating procedures shall describe an orderly, 
simple shutdown and/or product diversion procedure, and any 
other actions to be taken in the event of an emergency, includ- 
ing loss of communications, power, and so forth. 

4.1.2 Facility operators shall conduct reviews or inspec- 
tions of product receipt operations to ensure that procedures 
are followed to prevent tank overfills. 

4.1.3 In accordance with good management of change 
practices, the written operating procedures shall be reviewed 
on a regular basis and rewritten or amended as facility opera- 
tor and/or transporter practices, products, equipment, tanks 
and tank assignments, instrumentation, systems and condi- 
tions change, or whenever applicable regulatory requirements 
change. 

4.1 .4 Because equipment, instrumentation, tanks, and types 
of facility and transporter operations differ, one set of general 
operating procedures cannot apply to all facilities, and may 
not even be applicable to all tanks or operations within a facil- 
ity. Therefore, when necessary, written operating procedures 
shall be prepared for specific locations, tanks, and local con- 
ditions that address the items covered in this document. 

4.2 PLANNING THE PRODUCT RECEIPT 

4.2.1 To ensure that sufficient tank capacity will be avail- 
able, prior to delivery the product quantities to be received 
shall have been determined and the written procedures estab- 
lished. Planning shall be conducted sufficiently ahead of 
delivery so as to minimize the need for last minute product 
transfers or withdrawals from the designated receiving tank 
prior to receipt. 

4.2.1 A To provide for a safety margin with respect to over- 
fill, the normal capacity (normal fill level) of each tank should 
be used in calculating available capacity. 



API Recommended Practice 2350 



4.2.1.2 The anticipated final liquid product level in each 
tank shall be determined prior to each specific scheduled 
receipt and should not exceed the safe fill level. 

4.2.2 The facility operator shall assign required duties to 
designated personnel prior to start of the receipt. 

4.2.3 Specific written instructions for the receipt shall be 
prepared and reviewed, as appropriate, with personnel from 
all involved transporters and facility operators. These instruc- 
tions shall include normal operational controls and proce- 
dures for tank receipts that fill tanks to the normal fill level. A 
higher level of readiness and control is needed when tanks are 
filled above the normal fill level and when switching from 
one tank to another during the same receipt. 

4.2.4 Before the product is transferred or received, a proper 
valve line-up shall be verified to ensure that the product will 
be delivered into the designated tank or tanks. Where piping 
is connected from the same receiving manifold to different 
tanks, care must be taken to ensure the following: 

a. Only the inlet valves for those tanks designated to receive 
product shall be open. 

b. The inlet valves for all other tanks should be closed. 

4.2.5 Drain valves for dikes where receiving tanks are 
located (secondary containment) should normally be kept 
closed during product receipt. 

Note: Dike drain valves should always be kept closed except when 
draining water out of dikes. 

4.2.6 Prior to starting product transfer to attended facilities, 
communications shall be established between the transporter 
and the facility operator, and maintained throughout the prod- 
uct transfer. 

4.3 ELECTRONIC SYSTEM INTEGRITY TESTS 

4.3.1 Prior to starting product transfer to unattended facili- 
ties, transporters shall ensure that electronic supervision and 
alarm/signal systems are operating properly by conducting a 
system electronic integrity test. 

4.3.1 .1 System electronic integrity operational tests should 
be conducted within 24 hours prior to every receipt. 

4.3.1 .2 If receipts are so frequent that conducting the sys- 
tem operational tests prior to each receipt are impractical, 
tests should be conducted at least weekly. 

4.3.1.3 System operational tests should be conducted 
monthly for each facility and in addition within 24 hours 
prior to each receipt for facilities where receipts occur less 
than once a month (see 4.3.1.1). 



4.3.1.4 Other appropriate methods of system electronic 
integrity tests, such as automatic continuous self testing, are 
acceptable. 

4.3.2 Documentation of system electronic integrity opera- 
tional checks should be maintained on file as required by 
facility operator policy or regulation. 

4.3.3 In the event that the system on the tank designated to 
receive product is not operational and repairs cannot be made 
in time, the receipt shall be handled in one of the following 
ways: 

a. Directed into an alternate tank with a functioning alarm/ 
signal system, 

b. Handled as a receipt into a tank in an attended facility 
without overfill protection systems (see 2.1), 

c. Cancelled (see 3.1 .3). 

4.4 MONITORING THE RECEIPT 

4.4.1 The written operating procedures shall require regu- 
larly scheduled monitoring of product receipts in accordance 
with 2,1, 2.2, 3.1, and 3.2. Monitoring may be conducted on 
site or remotely, either manually or electronically, and shall 
include written or computer records of product movement 
and changes in flow rates during receipts. The written operat- 
ing procedures shall require that regularly scheduled compar- 
isons and recording of the following information be made, 
based on the initial tank capacity, the initial or changed flow 
rates, and the estimated filling time: 

a. The remaining available tank capacity shall be compared 
to the remaining volume of product to be received. 

b. The product level indicated on the instruments shall be 
compared to the expected level at any given time during the 
product transfer. 

4.4.2 Tanks that are connected to the same product mani- 
fold but which are not scheduled to receive product shall be 
monitored to ensure that their inlet valves are closed and that 
they are not receiving flow through partly open or defective 
valves. 

4.5 COMPLETING THE RECEIPT 

At the conclusion of the receipt, the facility receiving system 
shall be secured. This includes closing tank inlet valves that 
were opened for product receipt, and where appropriate, clos- 
ing the facility product receipt valve(s) or manifold valves, 
dock valves, and other safeguards appropriate for the facility. 

4.6 EMERGENCY PROCEDURES AND PLANNING 

4.6.1 Both the facility operator and transporter shall pre- 
pare and have available orderly, clearly written emergency 
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procedures and operating instructions for handling various 
types of potential emergencies, including the following: 

a. Action (emergency shutdown or product diversion) to be 
taken in the event of an alarm/signal. 

b. Action to be taken in the event of an overfill and subse- 
quent product and vapor cloud release. 

See Table 1 for a summary of actions to be taken for tank 
overfill protection. 

4.6.2 Emergency procedures and instructions shall be 
revised as needed to reflect changes in operating conditions or 
regulatory requirements. 

4.6.3 Appropriate emergency procedures to be followed in 
the event of a mechanical instrumentation, or electrical fail- 
ure shall be in writing and available at the facility. For facili- 
ties with manual operations (see requirements of 2.1) ? and 
facilities where the transporters control receipts, the emer- 
gency procedures shall be developed by the facility operator, 
with the assistance of the transporter, as required, and be 
available, in waiting, at the facility and at the transporter's 
point of operation or control. 

4.6.4 Provisions shall be made for appropriate means of 
communications between transporters and facility operators 
in the event of an emergency, including, but not limited to, 
pipeline telephone systems, public or private telephones, 
computer networks, and facility radios. 

4.6.5 Facility operator and transporter personnel shall be 
trained in the facility emergency procedures, emergency 
response, and means of communications, hi the United 
States, OSHA 1910.120(q) requirements may apply to train- 



ing for facility personnel serving as emergency responders — 
even if only at the "First Responder Awareness" level. 

47 PERSONNEL PERFORMANCE AND TRAINING 

4.7.1 Knowledgeable and qualified personnel are an impor- 
tant element of every tank overfill protection program, 
regardless of the sophistication of the overfill protection sys- 
tem. Programs shall be developed by facility operators and 
transporters to train personnel engaged in transfer operations, 
including those persons assigned to test, inspect, and main- 
tain overfill protection systems. These programs shall be 
reviewed, and altered as necessary, as operating procedures, 
equipment, instrumentation or regulatory requirements 
change. Personnel from facility operators, transporters, and/ 
or contractors who are assigned to test, inspect, and maintain 
overfill protection systems shall be trained and qualified in 
the specific procedures associated with such systems. 

4.7.2 Before personnel from facility operators and trans- 
porters are assigned to participate in a product transfer or 
receipt, they shall be thoroughly familial* with the written pro- 
cedures and operating instructions, their duties, the operation 
of the overfill protection system, the alarm/signal system, the 
emergency procedures and shall have received any mandatory 
training. 

4.7.3 The training given to personnel shall be documented. 
This documentation shall include the type and content of the 
training programs and materials, the training date(s), the 
names of the persons trained, and the names of the instructors 
or supervisors. 



Table 1— Tank Overfill Protection Summary Chart 



Point of Action 


Attended Facilities Without 
Automatic Detectors 


Attended & Unattended Facilities with Automatic Detectors 


Product Level 


Manual Action 


Signal 


Automatic/Manual Action 


Overfill level 
(maximum capacity) 


Initiate immediate response and/or 
emergency action. 


After 
H-HL 


Initiate immediate response and/or emergency action. 


Safe fill level 
(tank rated capacity) 


Product level not to be exceeded. 
Immediately shut down or divert flow 
so overfill level not reached 


H-HL 


High-high-level signals if safe fill signal level exceeded 
Immediately shut down or divert flow either manually or 
automatically so overfill level not reached. 


Nomial fill level 
(normal capacity) 


Start manual overfill prevention to shut 
down or divert flow so safe fill level 
not exceeded. 


HL 
Pie-signal 


High-level signals if normal fill level exceeded. Start 
automatic or manual overfill prevention to shut down or 
divert flow so safe fill level not exceeded 


Pre-signal a 


n.a. 


Gauge a 
System 


Product at level where initial manual or automatic action 
may be started. 


Loss of monitoring data 
(power loss or system 
failure) 


n.a. 


No Signal 


Stop or divert product flow. 



Notes: 

1. In single-stage and two-stage detector systems, the high-high-level (H-HL) detector shall be independent of the gauge system. 

2. When a high-level (HL) detector is used only for pre-signal purposes, it may he connected to the gauge system. 

a The gauge system may also be used for pre-signal purposes, independent of high-level and/or high-high-level detection devices. 
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4.7.4 To maintain competency, the performance of facility 
operator and transporter personnel shall be regularly moni- 
tored by supervisors or other appropriate personnel, and 
remedial or refresher training shall be provided as necessary, 
or when operating conditions, equipment, instrumentation, or 
regulatory requirements change. 

4.8 TESTING, INSPECTION, AND MAINTENANCE 

4.8.1 Written procedures for testing, inspecting, and main- 
taining an overfill protection system shall be developed by the 
facility operator. Where appropriate, the facility operator shall 
consult with the transporter regarding the development of 
these procedures. 

4.8.1.1 The manufacturer's recommendations should be 
taken into consideration when developing procedures for test- 
ing, inspecting, and maintaining an overfill protection system. 

4.8.1 .2 The testing procedures should be in a sequential 
format to ensure safe, consistent practices, and the testing 
procedures should be accessible to personnel responsible for 
the testing, inspection, and maintenance of the system. 

4.8.1 .3 Industry standards, government regulations, facility 
operator policies, and special situations may necessitate addi- 
tional inspection, testing, and maintenance procedures. 

4.8.2 Schedules shall be established as shown below for 
periodic testing, inspection, and maintenance to ensure the 
accuracy and proper operation of tank level gauges, detector 
alarms/signals, floats, displacers, automatic shutdown sys- 
tems, electronic supervision, and other equipment and instru- 
mentation associated with product transfer: 

a. An overfill protection system shall be tested on initial 
installation and retested frequently enough as required there- 
after to determine its reliability and to develop data that 
establishes the testing, maintenance, and inspection 
schedules. 

b. The facility operator shall establish these schedules based 
on experience and performance; however, the inspection and 
testing interval shall not exceed 1 year. 

c. Specific recommendations of the relevant equipment man- 
ufacturer should be considered when establishing inspection 
and maintenance procedures and intervals. 

4.8.3 Testing and inspecting overfill protection systems 
should be simple and easy. The testing should duplicate an 
actual high liquid level situation as realistically and as closely 
as possible; however, the test should not require filling the 
tank above its nonnal capacity. Most systems have provisions 



for simulating conditions that activate the detector and alarm/ 
signal. 

4.8.4 Inspection procedures that are specific to the system 
in use should be established, similar to the following example: 

a. Open the switch mechanism and inspect for moisture, cor- 
rosion, and cleanliness of the contact points. It should be noted 
that although the switch is normally located outside the tank 
vapor space, access may constitute a confined space entry. 

b. From the outside, without entering the tank, visually 
inspect the internal mechanism to ensure that the displacers 
are hanging free, cables are not kinked, and so forth. 

c. Thoroughly inspect the internal mechanism and the detec- 
tor setting whenever the tank is out of service for internal 
work or inspection. 

4.8.5 Maintenance instructions should include diagnostic 
routines to permit prompt identification and repair of failures 
in accordance with manufacturers' recommendations. 

4.8.6 The source of false alarms/signals should be deter- 
mined and corrected as quickly as possible. If false alarms/ 
signals are experienced frequently, they can cause personnel 
to lose confidence in the overfill protection system and lead to 
deviation from the established operating and emergency 
response procedures. 

4.8.7 Written records of overfill protection system testing, 
inspection, and maintenance shall be maintained for at least 
three years (or longer if required by facility operator policy or 
regulations). 

4.9 ABNORMAL CONDITIONS 

4.9.1 Facility operators and transporters shall develop writ- 
ten procedures and train personnel to provide for the proper 
course of action in the event that the overfill protection sys- 
tem fails, hi the event of abnormal conditions (operating, 
equipment, environmental, weather related, and so forth), 
these procedures shall include assigning personnel to be in 
attendance at normally unattended facilities during product 
receipt from transporters. 

4.9.2 Facility operators and transporters shall develop writ- 
ten procedures that provide for the proper course of action in 
the event that a mechanical or electrical power failure affect- 
ing the detector system occurs in an unattended facility. These 
procedures shall be written in accordance with the manual 
gauging operations given in 2.1 for attended facilities without 
detectors, which provides for using on-site personnel to 
gauge tanks during product transfer until such time that the 
detector system is repaired and back in operation. 



APPENDIX A— OVERFILL PROTECTION SYSTEM INSTALLATION 



A.1 General 

A. 1.1 It is important for an overfill protection system to 
be installed correctly, inspected and tested after installation, 
and then inspected and tested periodically to ensure its reli- 
ability. Where work requires personnel to go onto floating 
roofs reference should be made to API RP 2026 Safe 
Access/ Egress Involving Floating Roofs of Storage Tanks in 
Petroleum Service. 

A.1 .2 The method of overfill protection system installation 
depends on the following criteria: 

a. The type of liquid level detector and alarm/signal system 
used. 

b. The type, size, configuration, and condition of the tank. 

c. Whether the tank is existing (either in or out of service) or 
a new construction. 

d. The desirability of taking a tank out of service, if required, 
for installations involving hot work. (See API RP 2009 for 
guidance on hot work and API RP 2201 if hot tapping is 
required when installing overfill protection systems on tanks 
that are in service.) 

A.1 .3 Many methods exist for installing the various avail- 
able liquid level detectors. The following two methods are the 
most commonly used: 

a. In external installations, the detector is normally mounted 
in a chamber at grade level to allow for easy inspection, test- 
ing, and maintenance. An example of this method of 
installation is shown in Figure A-l. 

b. Top mounting the detector on a tank does not usually 
require piping or hot work. This method of installation has 
been used successfully on covered and open-top floating-roof 
tanks and on cone-roof tanks with internal floaters. Examples 
are shown in Figures A-2 and A-3. 

A.2 Positioning of Single-stage System 
High-high-level Detectors 

A.2.1 In a single-stage system, the high-high-level alarm/ 
signal activates w r hen the product level reaches the high-high- 
level detector point. This point is usually set at a product level 
in the tank that is at or above the predetermined safe fill level 
(tank rated capacity), depending on the facility operator and 
transporter practices. 

A.2.2 When a single high-high-level detector is installed on 
a tank, it should be positioned at a level point that will allow 
facility operator and/or transporter personnel adequate time to 
acknowledge and respond to the high-high-level alarm/signal 



before an undesired event occurs. Once this response lime is 
determined, the level height in inches equivalent to any num- 
ber of minutes of product flow may be calculated using the 
formula in A.4.3. 

A.3 Positioning of Two-stage System 
High-high-level Detectors 

A.3.1 In a two-stage system, the first (high-level) alarm/ 
signal activates when the product level surpasses the normal 
fill level (normal capacity) and before it reaches the safe fill 
level. The second (high-high-level) alarm/signal activates 
when the product level reaches the higli-high-level detection 
point. This point is usually set at or above the safe fill level 
(tank rated capacity), depending on the facility operator and 
transporter practices. 

A.3. 2 In a single-stage system, where a single high-high- 
level detector is installed on a tank, it should be positioned 
below the overfill level (maximum capacity) to allow the 
facility operator and/or transporter personnel adequate time to 
acknowledge and respond to the high-high-level alarm/signal 
before an undesired event occurs. Once this response time is 
determined, the level height in inches equivalent to any num- 
ber of minutes of product flow may be calculated using the 
formula in A.4.3. 

A. 3. 3 hi a two- stage system, the high-high-level detector 
should be positioned the same as the high-high-level detector 
in a single-stage system. In a two-stage system, the high-level 
detector should be set so that it is at least the same distance 
below the high-high-level detector as the high-high-level 
detector is below the overfill level. 

A.3.4 When two-stage detector (high-level and high-high- 
level) systems are used, these systems shall be designed so 
that the failure of any component in the first stage (high-level 
detector) does not interfere with or incapacitate the operation 
of the second stage (high-high-level detector). 

A.4 Determining Response Time 

A.4.1 Response time is the maximum time allowable 
between the activation of an alarm/signal and the next subse- 
quent predetermined event. 

A.4.2 The high-high-level alami/signal in a single-stage sys- 
tem and the high-high-level alarm/signal in a two-stage system 
shall be installed at levels designed to provide sufficient 
response time for an orderly shutdown or diversion of product 
to take place before an overfill occurs (see Figure A-4). 
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Figure A-1— Example External Chamber-type Detector Installation 
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Note: External floating-roof tanks will require a support bracket attached to the tank exterior platform and stairway. It may be necessary to 
modify the existing platform to allow proper installation and safe inspection and maintenance of the alarm system. Electrical-conduit and 
operation-checker-cable mounts are to be secured to the tank top railing and stairway structure, using clamping devices. 



Figure A-2— Example of a Two-stage Detector Installation for an External Floating-roof Tank 
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Figure A-3— Example of a Two-stage Detector Installation for a Cone-roof Tank 
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Note: The times indicated are provided as an example only. Actual times may be longer or shorter, depending upon tank conditions and the facil- 
ity operator practices. 



Figure A-A — Example of Tank Level Settings Based on Response Time in a Two-stage Detector System 
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A. 4.3 As a minimum, this amount of response time is 
determined by the volume of product that would enter the 
tank at the maximum fill rate: 

a. During the time the facility operator (or transporter) would 
need to get personnel into position to start the shutdown or 
diversion, plus 

b. The time required from the initiation to the completion of 
shutdown or diversion. 

Once the amount of time required for response has been 
established by the operator (and agreed to by the transporter, 
where appropriate) the height differential in inches equivalent 
to any number of minutes of product flow into a specific tank 
may be calculated using the following formula: 



h m = TFHI5C 



where 



h m = height differential, in inches, 

T = minutes of product flow required to implement 
response action, 

F = maximum flow rate into tank in barrels per 
hour, 

H = total tank height, in ft 

C = tank rated capacity, in barrels. 

A. 4.4 Following are some considerations for determining 
total tank height: 

a. Floating-roof tanks: When calculating total tank height for 
floating roof tanks (internal and external covered or open- 
top), some facility operators consider the floating roof high- 
leg setting or low-leg setting (depending on facility operator 
practices as to how legs are normally set for tanks in opera- 
tion) to be the bottom of the tank. This is to prevent 
withdrawing so much product that a void space is created 
between the floating roof and the remaining product level. 
The overfill level is considered to be the point where the tank 
is filled as close to the top of the shell or overflows as permit- 
ted by facility operator procedures without a spill or overflow 
occurring, and where the floating roof does not contact any 
shell appurtenances or expose the roof seals. 

b. Cone-roof tanks: When calculating the total tank height 
for cone-roof tanks, some facility operators consider the bot- 
tom to be the point at which the pump loses suction. This is to 
avoid pumping out tank bottoms. The overfill level is consid- 
ered to be the point where the amount of product contained in 
the tank is as close to the top of the shell or overfills as per- 
mitted by facility operator procedures without a spill or 
overflow occurring. 

c. All tanks: When calculating the total tank height for all 
tanks, facility operators must also consider physical tank con- 
ditions (leaks, structural strength, and so forth) or operating 



practices (partial or split product receipts, relief conditions, 
and so forth) that limit the tank capacity to less than normal 

A.4.5 To provide a safety factor, some facility operators 
consider the true working capacity of the tank to be the space 
between the bottom of the tank (as described above) and the 
safe fill level (tank rated capacity). 

A.4.6 Following is an example using the formula in A.4.3 
to calculate the height differential required to provide 15 min. 
of product flow time, which (in this example only) is deemed 
sufficient for reaction and shutdown or diversion of product 
by facility operator or transporter personnel before reaching 
the overfill level (maximum capacity): 

Assuming that the maximum flow rate (F) is 4000 barrels 
per hour, the total tank height (H) is 50 ft, and the tank rated 
capacity (Q is 50,000 barrels; the detector will have to be 
placed 12 in. below the overfill level to provide 15 min. 
response time (7): 

TFH/5C - h m = (15)(4000)(50)/5(50,000) = 12 in. 



TFH 

5C 



= h m = 



(15)(4000)(50) = 12in 
5(50,000) 



Note: Although 1.5 min. is used in the example, the actual time will 
vary depending on the operating conditions and the response 
requirements. 

A.5 Automatic Tank Gauges 

A. 5.1 Many tanks are equipped with mechanical or elec- 
tronic automatic tank gauges. A malfunction of these gauges 
may contribute to tank overfills. 

A.5.2 Electronic automatic tank gauging systems with self- 
check features are available that can reduce the risk of a prod- 
uct overfill caused by the malfunction of an automatic tank 
gauge. 

A.5.3 Failure of self-checking automatic tank gauging sys- 
tems is possible. To meet the requirements of NFPA 30-2003, 
Section 4.6.1.1(2) and (3), independent level switches must 
be installed for single and two-stage level detector systems. 

A.6 Selection and Installation of Contact 
Switches and Probes 

A. 6.1 In the selection of high-level and high-high-level 
detector contact switches/probes, consideration should be 
given to problems associated with vibration and with corro- 
sion from humid or marine environments. 

A. 6 .2 Many electronic level detector systems use probes as 
sensing devices. False alarms may occur due to condensation 
of vapors on these probes. To minimize vapor build-up on 
side mounted probes, probes should be installed at an angle of 
20° or more from the horizontal. 



APPENDIX B— DETERMINING TANK CAPACITY AND PRODUCT LEVELS 



B.1 General 

B.1 A The capacity of a tank depends on the tank's type, 
size, configuration, and condition, and on the specified design 
liquid tank product levels. For internal and external (covered 
and open-top) floating-roof tanks, tank capacity also depends 
on the type of floating roof, roof seal, roof cover, internal tank 
construction, and appurtenances. 

B.1 .2 Each tank covered by this standard should have a 
current, up-to-date tank strapping chart (tank record) that 
depicts the actual conditions in the tank. The key values 
entered on the chart (or tank record) shall be calculated and/or 
established by the facility operator (see Figures B-l and B-2). 
These values include: 

a. Normal capacity (normal fill level), 

b. Tank rated capacity (safe fill level), and 

c. Maximum capacity (overfill level), 

for each tank receiving product in the facilities covered by 
this document. 

B.1 ,2.1 Facility operators shall indicate the normal capac- 
ity (normal fill level), tank rated capacity (safe fill level), 
maximum capacity (overfill level), and any other critical 
capacities and levels on the tank strapping chart, record card, 
computer record and/or calibration chart, and make this infor- 
mation available to transporters. 

B.1 .2.2 The overfill level should be verified by an inspec- 
tion of the tank. The distance from the bottom of the overflow 
slot to the bottom of the tank should correspond to the last 
entry on the tank chart or record. 

B.1 .2.3 Tank capacity levels should be reflective of the 
floating roof and internal appurtenances. 

B.1 .2.4 If acceptable calibration charts are not available, 
tanks shall be calibrated in accordance with API Std 2550, 
and charts developed. 

B.1 .3 Management of change practices shall be applied 
and levels and detector settings adjusted whenever a tank is 
modified so as to affect its capacity. This includes, but is not 
limited to, operational changes (such as a change in receiving 
flow rates) and mechanical changes (such as providing a dou- 
ble bottom, adding an internal floating roof, changing con- 
struction of the floating roof, or placing a cover over an open- 
top tank). 

B.1 .4 Regardless of the capacity at any given level, if low 
pressure station piping relief is routed into a tank, extra 
capacity must be allowed for detector positioning. 

B.1. 5 Consult with the tank manufacturer if there is any 
question about tank capacity. 



B,2 Normal Capacity (Normal Fill Level) 

B.2.1 Normal capacity is the amount of product that can be 
contained in a tank when the tank is filled to its normal fill 
level. 

B.2.1 .1 The normal fill level is a predetermined distance 
below safe fill level (that is, normal capacity does not exceed 
tank rated capacity) and is usually as close to the top of the 
tank as permitted by facility operator procedures. 

B.2.1 .2 The normal fill level is a level that allows time for 
appropriate action for the flow to be completely stopped or 
diverted before the level of the product in the tank reaches the 
established safe fill level. This time depends on tank size, 
facility operator and transporter practices, the anticipated 
time of response, and the time for completion of the manual 
or automatic shutdown or diversion. 

For example, if it takes 15 min. to effectively stop product 
flow, the normal capacity would be determined by setting the 
normal fill level at least 15 min. below the safe fill level. 

B.2.1 .3 The normal fill level may also be a level deter- 
mined by the operator depending on physical tank conditions 
(leaks, structural strength, and so forth) or operating practices 
(partial or split product receipts, relief allowances, and so 
forth) that limit the tank capacity to less than normal. 

B.2.2 CONE (FIXED OR SEMI-FIXED) ROOF TANKS 
(WITHOUT AN INTERNAL FLOATING ROOF) 

Normal capacity for cone (fixed or semi-fixed) roof tanks 
(without an internal floating root) is when the tanks are filled 
to a predetermined level below the safe fill level (tank rated 
capacity), and the amount of product contained in the tanks is 
as close to their safe fill level as permitted by facility operator 
procedures. 

Note: Li lieu of other information or if operating details are 
unknown, the normal, capacity would typically be 90% of the maxi- 
mum capacity of cone (fixed) roof tanks. 

B.2.3 INTERNAL FLOATING-ROOF TANKS (AND 
COVERED EXTERNAL FLOATING-ROOF 
TANKS) 

Normal capacity for internal floating-roof tanks and exter- 
nal (open-top) tanks that have been converted to covered 
floating-roof tanks is when the tanks are filled to a predeter- 
mined elevation below the safe fill level (tank rated capacity), 
as close to the safe fill level as permitted by facility operator 
practices, and the floating roof does not contact either the 
external roof or tank shell appurtenances. 
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Note: Li Lieu of other information or if operating details are not 
known, the normal capacity would typically be 80% of the maxi- 
mum capacity of covered and internal floating-roof tanks. 

B.2.4 EXTERNAL (OPEN-TOP) FLOATING-ROOF 
TANK 

Normal capacity for external (open-top) floating-roof tanks 
is when the tanks are filled to a predetermined elevation 
below the safe fill level (tank rated capacity), which is as 
close to the safe fill level as permitted by facility operator 
practices, and the floating roof does not contact any shell 
appurtenances or expose the roof seals. 

Note: In lieu of other information or if operating details are 
unknown, the normal capacity would typically be 85% of the maxi- 
mum capacity of open-top floating-roof tanks. 

B.3 Tank Rated Capacity (Safe Fill Level) 

B.3.1 TANK RATED CAPACITY 

Tank rated capacity is the amount of product that a tank 
can contain when the tank is filled to its safe fill level. 

B.3.1 .1 The safe fill level is set at a predetermined distance 
below the overfill level and is as close to the top of the tank as 
permitted by facility operator procedures. 

B.3.1 .2 The safe fill level is a level that allows time for 
appropriate action to be taken for the flow to be completely 
stopped or diverted before the level of the product in the 
tank reaches the established overfill level. This time 
depends on tank size, facility operator and transporter prac- 
tices, the anticipated time of response, and the time for com- 
pletion of the manual or automatic shutdown or diversion. 
For example, if it takes 10 min. to effectively stop product 
receipt, the tank fill capacity is determined by setting the 
safe fill level at least 10 min. below the overfill level. 

B.3.1 .3 The safe fill level is also determined by the facility 
operator, depending on physical tank conditions (leaks, struc- 
tural strength, and so forth) or the facility operating practices 
(partial or split product receipts, relief allowances, and so 
forth) that limit the tank capacity to less than normal. 

B.3.2 CONE (FIXED OR SEMI-FIXED) ROOF TANKS 
(WITHOUT INTERNAL FLOATING ROOFS) 

The tank rated capacity for cone (fixed or semi-fixed) roof 
tanks (without internal floating roofs) is the contained prod- 
uct volume up to the horizontal leg of the angle at the top of 
the shell (where the shell joins the roof plate steel) or when 
the liquid is approximately 6 in. below the invert level of the 
side mounted foam piping or the tank vents, whichever is 
lower. The tank rated capacity is usually achieved when tanks 
are filled as close to their maximum capacity as permitted by 
facility operator procedures. 



Note: In lieu of other information or if operating details are 
unknown, the tank rated capacity of cone (fixed) roof tanks is typi- 
cally 97% of the maximum capacity. 

B.3.3 INTERNAL FLOATING-ROOF TANKS (AND 
COVERED EXTERNAL FLOATING-ROOF 
TANKS) 

The tank rated capacity for cone-roof tanks with internal 
floating roofs or decks (and external [open-top] floating-roof 
tanks that have been provided with fixed roofs [converted to 
covered internal floating-roof tanks]) is the contained volume 
when either of the following conditions exist: 

a. The highest point of the internal floating roof or the deck 
is 6 in. below any contact with interior obstructions, or 

b. The liquid is approximately 6 in. below the lower edge of 
the overfill scuppers, vent openings, or foam chambers. 

The tank rated capacity is usually achieved when the tanks 
are filled as close as possible to their maximum capacity as 
permitted by facility operator procedures and to the maxi- 
mum allowable elevation of the floating roof (without impact- 
ing the external roof or contacting tank shell appurtenances). 

Note: In lieu of other information or if operating details are not 
known, the tank rated capacity is typically 90% of the maximum 
capacity of cone (fixed or semi-fixed) roof tanks with internal float- 
ing roofs or decks. 

B.3.4 EXTERNAL (OPEN-TOP) FLOATSNG-ROOF 
TANKS (CAPPED AND UNCOVERED) 

The tank rated capacity for external (open-top) floating- 
roof tanks and external (open-top) floating-roof tanks pro- 
vided with weatherproof caps, geodesic domes, or similar 
covers is when the tanks are filled as close as possible to their 
maximum capacity as allowed by facility operator procedures 
(usually a predetermined distance below maximum fill 
height). For external floating-roof tanks, either open-top or 
with covers, the tank rated capacity is determined based on 
the following: 

a. When only a mechanical shoe primary seal is used, the 
tank rated capacity is the contained volume when the topmost 
part of the shoe is approximately 6 in. above the shell rim. 

b. When only a flexible wiper, resilient filled or other type of 
primary seal is used, the tank rated capacity is the contained 
volume when the topmost part of the upper seal is approxi- 
mately 6 in. below' the shell rim. 

c. When a secondary seal is used in combination with any 
type of primary seal, the tank rated capacity is the contained 
volume when the topmost part of the secondary seal is 
approximately 6 in. below 7 the shell rim. 

d. The tank rated capacity must provide for approximately 
6 in. of clearance between the roof and foam piping, appur- 
tenances, or other shell protrusions. 
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Note 1: In lieu of other information or if operating details are 
unknown, the tank rated capacity of external floating-roof tanks is 
95% of the rnaxixmirn capacity of the tanks. 

Note 2: When a weatherproof cap. geodesic dome, or similar cover 
is placed on top of an open-top floating-roof tank, the tank rated 
capacity shall be reevaluated to determine if a change is required 



B„4 Maximum Capacity (Overfill Level) 

B.4.1 Maximum capacity is the level of product in a tank 
when the tank is filled to its overfill level. This is the level at 
which any additional product will overflow and spill out of 
the tank, and/or in the case of a floating-roof tank, where con- 
tact or damage will occur between the floating roof and the 
tank structure or appurtenances. 
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TANK DETECTOR LEVEL AND FILL LEVEL WORK SHEET 



FACILITY 

TANK NO. 

LOCATION 

PREPARED BY . 
DATE 



I. Receipt Information 

1 . Maximum fill rate = A 

2. Maximum time for facility operator or 
transporter to begin to start 
shutdown or diversion = B 

3. Maximum time to achieve total 
shutdown or diversion after facility operator 
or transporter begins response = C 

4. D^BxC 

5. Volume received during time period 
E=AxD 

6. Volume (£) with safety factor (F) 
F= Ex (factor) safety factor 

to be determined by facility operator 

II. Detector and Fill Level Settings 

1. Overfill Level (maximum capacity) 



2. High-level Detector Setting 

Single and Two Stage Systems 

3. High-high Level Detector Setting 

Two Stage Systems (only) 





(barrels/minute) 
(minutes) 


(A) 




(B) 




(minutes) 
(minutes) 


(C) 
(D) 




(barrels) 


(E) 




(barrels) 


(F) 


OFL = 


(barrels) 




OFL = 


Feet 


Inches 


OFL = 


(barrels) 




OFL= 


Feet 


Inches 


HLD = (HHLD) - 


-(C) 


(barrels) 


HLD = 


Feet 


Inches 



4. Normal Fill Level (normal capacity) 

Single Stage System 



HE. Tank Information 

High Legs Level : 

Low Legs Level = 



NF = 


(HHLD) - 


-(D) 




(barrels) 


NF = 






Feet 


Inches 


NF = 


(HHLD) - 


-(B) 




(barrels) 


NF = 






Feet 


Inches 


Barrels = 






Feet 


Inches 


Barrels = 






Feet 


inches 



Figure B-1— Tank Detector Level and Fill Level V\fork Sheet 
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TANK OVERFILL LEVEL WORK SHEET AND RECORD 



FACILITY 

TANK NO. 

LOCATION 

PREPARED BY. 
DATE 



Tank Height (H) = 

Liquid Level (L) = 

Available Storage (S) = 

Other Allowances (A) = 

Roof Thickness (Calculated) (RT) = 

Overfill Level (Calculated) (OFL) = 



(OFL)= H-RT-A = H( ) - RT ( )-A( ) 



Feet 




Inches 


Feet 




Inches 


Feet 




Inches 


Feet 




Inches 


Feet 




Inches 


Feet 




Inches 




Feet 


Incl 



Inches (A = if no internal appurtenances) 



Note: (H) and (L) must be measured from the same place (both from tank bottom or striker plate). 



Interna! Floating-roof 
Tank (example) 



External Floating-roof 
Tank (example) 




Dimensions 



(H) = Tank height (from floor or from 
striker plate) 

(L) = Liquid level (from floor or from 
striker plate) 

(RT) = Effective roof thickness (from 
liquid level to upper seal extension) 

(S) = Storage available until overfill 
level is reached 

(A) = Allowances for other 
appurtenances in the shell 

(OFL) = Overfill level above which 
spill or damage will occur 



i7 m z / / 



% 



Striker 
plate 



OFL 



RT 



Figure B-2— Tank Overfill Level \Afork Sheet and Record 



APPENDIX C— OVERFILL PROTECTION EQUIPMENT 



C.1 General 

C.1.1 Protection against tank overfill is best achieved by 
awareness of the available tank capacity and inventory and by 
the careful monitoring and control of product movement. The 
monitoring of available tank capacity may be accomplished 
either manually or by use of automatic overfill protection 
equipment. Automatic overfill protection systems are 
required at unattended facilities. They are not required at 
attended facilities. 

C.1. 2 Where overfill protection systems are provided on 
tanks that receive Class I or II liquids from mainline pipelines 
and/or marine vessels, they shall comply with the require- 
ments of NFPA 30-2003, Sections 4.6.1.1, 4.6.1.2 and 
4.6.1.3. Overflow protection systems shall be independent of 
any tank gauging device or system. 

C.1 .3 Depending on the specific design and type of opera- 
tion, the overfill protection system typically includes the fol- 
lowing basic components: 

a. Liquid level detectors and alarm/signal switches/probes. 

b. Alarm/signal control panels. 

c. Audible and visible alarm/signals. 

d. Power operated product flow control valves for automatic 
shutdown or product diversion. 

C.1 .4 Overfill protection system components must be com- 
patible and work together to provide a dependable overfill 
protection system. An example of a typical overfill protection 
system is shown in Figure C- 1 . 

C.1 .5 Overfill protection systems shall be electrically 
supervised or provided with equivalent protection against 
failure, as required by NFPA 30-2003, Section 4.6.1.2. This 
means that an overfill protection system shall activate an 
alarm/signal either when power is interrupted or when the 
detector switch is activated because of an alarm/signal situa- 
tion and the circuit is open. 

C.1 .6 Facility operators and transporters shall ensure that 
the overfill protection systems are in good operating condi- 
tion at all times and are not disabled or disconnected. Opera- 
tors and transporters shall inspect and maintain gauging 
equipment, detector instrumentation, and related systems at 
least once a year as required by NFPA 30-2003, Section 
4.6.1.3(3). 

C.1 .7 Each facility and each tank covered by this document 
requires individual study and design criteria for the proper 
selection and installation of components to meet the operat- 
ing and maintenance requirements of the facility operator and 
the transporter and to comply with this document and the 
applicable codes and regulations. 



C.1 .8 Since tanks covered by this document contain vola- 
tile, flammable hydrocarbon (Class I) or combustible hydro- 
carbon (Class II) liquids, the overfill protection system design 
shall specify equipment appropriate for the electrical classifi- 
cation of the area in which the equipment is to be installed 
(see API Std 500). 

C.1 .9 Where alternate Class I or Class II fuels, mixed fuels, 
and fuel additives are stored in tanks with overfill protection 
systems, the equipment and components shall be constructed 
of materials compatible with the liquids stored. 

C.2 Liquid Level Detectors 

C.2.1 Detectors are devices used to determine the product 
level in storage tanks and are activated as the product in the 
tank reaches pre-established levels. The following types of 
detectors (see examples in Figures C-2, C-3, and C-4) are 
typical of those used in tanks covered by this document: 

a. Float detectors are used to determine product level in 
cone-roof tanks. As a tank is filled the product rises within the 
tank, lifting the float until a predetermined fill level is 
reached. The float then activates the alarm/signal 

b. Displacer detectors are sometimes used in lieu of float 
detectors to determine product level in tanks where product 
may be agitated, surging, foaming, or have low specific gravity. 

c. Opto-electronic detectors are used to determine product 
level in all types of Class I and Class II liquid storage tanks. 
Opto-electronic level detectors have an infrared light source 
that passes through a light conductor, which is refracted at a 
different rate when surrounded by air or gas vapors. For 
example, when a product rising in the tank reaches the pre- 
established high-level and high-high-level points, the liquid 
spilling over into the detector changes the refraction rate in 
the sensor and activates the alarm/signal. 

d. Weight (slack cable) detectors are used to determine prod- 
uct level in a floating-roof tank. As the tank is filled, the 
floating roof rises to a predetermined fill level where it contacts 
the weight. As the weight is lifted by the roof, the cable goes 
slack and the level switch opens, activating the alarm/signal. 

e. Densitometer (measuring gauge type) detectors use radio- 
active devices to identify liquid levels at predetermined 
positions. 

f. Other detectors also used include capacitance, thermal, 
infrared, optical, ultrasonic, radio-frequency emittance and 
gravity-mass measurement. 

C.2.2 Float detectors may be used in cone-roof tanks, or 
displacer detectors may be used in tanks containing agitated, 
surging, foaming, or low specific gravity products. 

C.2. 2.1 When selecting float or displacer detectors, the 
facility operator must know the specific gravity of the product 
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Liquid-level detector N 



High-high lights 
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Test button 

On light 

Acknowledge button 



Alarm control panel 
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Figure C-1— - Example of a Two-stage Overfill Protection System 
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(weatherproof) 



Fioat/displacer 
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High or high-high J 
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Test and drain valves 
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Figure C-2— Example of an External Chamber-type Float Switch 
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Figure C-3— Example of an Optical High-level Detector 
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stored in the tank to ensure that the float or displacer will float 
on top of the liquid surface and not be submerged. 

C.2.2.2 Displacer and float detectors must be regularly 
inspected, tested, and properly maintained to ensure reliable 
operation. 

C.2.3 If weight detectors are used, the specific gravity of 
the product stored must be determined so that the displacer 
will float on top of the product in the event that the floating 
roof sinks. Weight detectors require regular inspection and 
maintenance to ensure operability. 

C.2.4 Capacitance, radio frequency emittance, and ultra- 
sonic level detectors are recommended for tanks outside the 
scope of this standard which store heavy, viscous petroleum 
liquids, such as asphalt and residual fuel oil, because they are 
less affected than float or displacer types by product buildup 
on the detector element. 

C.2.5 Opto-electronic detectors have control units 
equipped for simulation of alarm conditions to verify the 
operation of the control unit's circuit. An advantage of this 
type of detector is that die system can be easily tested, simu- 
lating actual alarm/signal conditions by subjecting the sensor 
to a small amount of liquid. 

C.2.6 Selection of detectors depends on many factors, 
including but not limited to the following: 

a. Type of tank, construction, tank appurtenances, and roof. 

b. Product stored in the tank. 

c. Weather, humidity, and other environmental conditions. 

d. Electrical rating and classification requirements. 

e. Type of alarm/signal required. 

f. Inspection, testing, and maintenance requirements. 

g. Facility operator and transporter policies, applicable codes 
and regulatory requirements. 

h. Failure modes. 

i. Static electricity discharge considerations. 

j. Hot work requirements during installation. 

k. Other factors resulting from local considerations and 

conditions. 

G.2.7 Caution should be exercised in the selection and 
installation of liquid level detectors and other overfill protec- 
tion system components in tanks, so that they do not create a 
point source for static electricity discharge from the surface 
of the liquid to the tank shell. (See API RP 2003). 

C.2.8 Apply good management of change procedures 
whenever changes occur in operating practices, products 
stored, tank modification, and so forth to ensure that the 
proper detectors are used. 



G.3 Alarm/Signal Control Panel 
(Annunciator) 

C.3.1 The overfill protection system alarm/signal control 
panel (annunciator) shall be located so that assigned facility 
operator and/or transporter personnel are readily alerted to 
take response action when a detector signals that the liquid 
level in a tank has reached a predetermined height. (See Fig- 
ure C-l). 

C.3.2 Different types of alarm/signal control panels can be 
used to monitor detectors and to provide output to other oper- 
ating devices. The final control panel selection depends on 
facility operator and transporter practices, the various func- 
tions desired, and the local requirements. 

C.3.3 Alarm/signal control panels or other devices used in 
lieu of alarm/signal control panels (that is, annunciators, com- 
puter display systems, and so forth) shall include appropriate 
visible and audible alarms with test features, power backup, 
and communications to remote locations, such as, but not 
limited to, the following: 

a. Alarm/signal indicator lights. Two visual indicator light 
lenses are recommended for each tank. If only one lens is 
used, the light should flash when the tank goes into alarm/sig- 
nal condition and light steadily after the alarm/signal is 
acknowledged. Lens colors may be selected in accordance 
with facility operator or transporter practices or local 
requirements. 

b. A control panel audible alarm/signal with an audible 
silence/acknowledge feature. 

c. A control panel and overflow prevention system self test 
feature. 

d. Device(s) to activate visible display signals and/or audible 
alarms to alert personnel at locations remote from the control 
panel location. 

e. Device(s) to activate power-operated valves for automatic 
shutdown or diversion. 

f. Device(s) to signal to, or communicate with, remote loca- 
tions (that is, pipeline control centers, facility operator remote 
offices, marine dock, security services, and so forth). 

g. A built-in battery system and alarm/signal to indicate a 
power failure to the alarm/signal control system. 

h. An electrical supervision system or equivalent, 
i. An alternate power supply when loss of main power sys- 
tem will result in an undetected high-level situation. 

C.3.4 Alarm/signal control panels should not have an oper- 
ating deactivation switch that turns off the system. The circuit 
breaker at the main electrical panel should be used only to 
deactivate the system for routine maintenance and testing. 

CA Audible and Visible Alarm/Signals 

C.4.1 In addition to the control panel alarm/signals, 
devices to alarm/signal high and high-high product level con- 
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ditions in tanks should be installed in other facility areas, such 
as the storage tank area, marine dock, pipeline manifold, and/ 
or transporter control location, where the devices can be 
readily seen and/or heard by the personnel in those areas who 
are responsible for initiating the corrective action to prevent 
an overfill Facilities where personnel are not on duty .full 
time during receipts shall ensure that the alarm/signals are 
activated at locations where personnel can respond and ini- 
tiate action to prevent an overfill incident. 

C.4.2 Selection of audible and visual alarm/signals (horns, 
lights, and so forth) shall comply with the electrical classifica- 
tion of the area in which they are installed (See API RP 500). 

C.4.3 To prevent confusion when any emergency condition 
develops, audible and visual alarms/signals associated with 
the overfill protection system should be distinctive from other 
alarms/signals installed in the facility or transporter location. 
In addition, in two-stage detector systems, the high-level 
alarm/signal should be distinctive from the high-high-level 
alarm/signal. 

C.4.4 The visual/audible alarms/signals shall be activated 
in the event of the following occurrences: 

a. Product level in the tank reaches the predetermined alarm/ 
signal level. 

b. Loss of the main electrical power at the facility. 

c. An electrical break or ground fault in the high-high-level 
detection system circuit or the alarm/signal, device circuit. 

d. The failure or malfunction of the high-high-level detection 
system control equipment (internal supervision) or signaling 
devices. 

e. The removal of triggering devices (floats, displacers, and 
so forth) from the system. 

C.5 Power-operated Valves 

C.5.1 Power-operated valves may be used for automatic 
shutdown or product flow diversion. Power-operated valves 
may be electrically, hydraulically, or pneumatically operated. 



C.5. 2 When automatic shutdown or diversion systems are 
provided, the receiving valve or valves for each tank shall be 
equipped with a power actuator that has provisions for both 
local and remote control. 

C.5.2.1 A hand-controlled switch should be provided that 
may be used to select the off, remote, or local control position. 

C.5. 2. 2 Position indicators should be provided that show 
the valve position and operation. 

C.5.2.3 The valve actuator shall also be equipped for man- 
ual operation. 

C.5.3 The valve travel time should prevent excessive pres- 
sure or hydraulic shock when the valve is closed. 

C .5. 3 . 1 An analysis shall be conducted by the facility oper- 
ator of the facility piping system to determine whether a relief 
system is needed to protect low-pressure manifold piping. 

C.5 .3 .2 The design and operation of the shutdown system 
shall be coordinated with, and be acceptable to, the trans- 
porter. 

C.5.4 When an alarm/signal is received that a tank has 
been filled to its predesignated automatic shut down or diver- 
sion level, the power-operated valve system shall provide for 
the following actions: 

a. Immediately start to close the valve(s) at the predeter- 
mined rate established by the facility operator and the 
transporter. 

b. Block out remote operation of the valve(s) until the alarm/ 
signal resets after transfer. 

c. The valve(s) should only be manually operable, at the 
valve location(s), as long as the product level in the tank 
remains above the high-high detector level setting. 

d. If a valve is being opened remotely when the high-high- 
level detector alarm/signal is received, the valve shall stop 
opening and immediately start to close at a predetermined rate. 

e. If a valve is being closed remotely when the high-high- 
level detector alarm/signal is received, the valve shall con- 
tinue to close at the predetermined rate. 
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The American Petroleum Institute provides additional resources and programs 
to the oil and natural gas industry which are based on API® Standards. For 
more information, contact: 



API Monogram® Licensing Program 



Phone: 202-962-4791 
Fax: 202-682-8070 



American Petroleum Institute Quality Registrar Phone: 202-962-4791 
(APIQR®) Fax: 202-682-8070 



API Spec Ql® Registration 



API Perforator Design Registration 



API Training Provider Certification Program 



Individual Certification Programs 



• Engine Oil Licensing and Certification System 
(EOLCS) 

• API PetroTEAM™ 

(Training, Education and Meetings) 



Phone: 202-962-4791 

Fax: 202-682-8070 

Phone: 202-962-4791 

Fax: 202-682-8070 

Phone: 202-682-8490 

Fax: 202-682-8070 

Phone: 202-682-8064 

Fax: 202-682-8348 

Phone: 202-682-8516 

Fax: 202-962-4739 

Phone: 202-682-8195 

Fax: 202-682-8222 



Check out the API Publications, Programs, and Services Catalog online at 
www.api.org. 
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